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DETAILED ACTION 

1 . The response of 7/29/2005 was received and considered. 

2. Claims 1, 3-1 1 & 13-22 are pending. 

Response to Arguments 

3. Applicant's arguments with respect to claims 1, 3-1 1 & 13-22 have been considered but 
are moot in view of the new ground(s) of rejection. However, a description of the newly-applied 
art is provided. Further, in light of Applicant's amendments to the claims, the rejections under 35 
U.S.C. §1 12 and objections to the claims, set forth in the previous Office Action, are withdrawn. 

4. The Schnurer reference discloses a method of determining if an object is infected with a 
virus by activating the target object (col. 7, lines 39-43) in a virtual environment (which contains 
essentially many objects that would be contained within a normal computer, such as files, 
databases, computer code, etc.). The effects of the virus are analyzed to determine by comparing 
the original objects/bait to standard samples (infected bait objects). However, Schnurer lacks 
explicitly using the information learned for cleaning the infected object. Chess teaches 
comparing original files to potentially virus-infected files to determine a difference fl[2-6) and, 
for example, if a file had no macros contained within it during the previous check (as indicated 
by the database), the macro will be removed (f32). While Chess is not activating potentially 
infected files explicitly, Chess is using the differences in the original data and the new/infected 
data to restore the infected data to its original state, thereby reversing the effect of a virus, 
allowing the system to clean unknown viruses flfl| 2, 6, 25-27 & 32). Therefore, it would have 
been obvious to modify Schnurer to use the knowledge gained from executing the potential 
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viruses in the virtual environment to then clean the infected file. One of ordinary skill in the art 
would have been motivated to perform such a modification to repair a file infected by an 
unknown virus, as taught by Chess 2, 6, 25-27 & 32). 

Claim Objections 

5. Claim 18 is objected to because of the following informalities: The dependency should 
be changed to claim 1 1 . Appropriate correction is required. 

Specification 

6. The disclosure is objected to because of the following informalities: The specification 
contains numerous grammatical informalities. Applicant's cooperation is requested in correcting 
any errors of which applicant may become aware in the specification. 

For example, on p. 16, "knowledge real-time learned", "and a virus's nature lies in the 
ability of camouflaging themselves" and "the virus will restores the host object" are 
minor grammatical informalities. 
Appropriate correction is required. 

Claim Rejections - 35 USC § 112 

7. The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the 
subject matter which the applicant regards as his invention. 
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8. Claims 1,3-11 & 13-22 are rejected under 35 U.S.C. 112, second paragraph, as being 
indefinite for failing to particularly point out and distinctly claim the subject matter which 
applicant regards as the invention. 

Regarding claims 1 & 1 1, it is unclear whether the computer viruses reside on "a 
computer" or on "a virtual computer circumstance". For the purposes of this Office Action, the 
computer viruses are understood to reside on the virtual computer circumstance. 

Regarding claims 1 & 1 1, it is unclear how it can be determined whether the target object 
contains a virus or not when viruses are already resident on the system. For the purposes of this 
Office Action, the Examiner assumes that the limitation "on which the computer viruses reside " 
(lines 3-4) means "on which the computer viruses will reside" or similar. 

Regarding claims 1 & 1 1, it is unclear whether "a plurality of objects or baits to be. 
infected" or "computer viruses" induces the virus infection. For the purposes of this Office 
Action, the computer viruses are understood to induce virus infection. 

Regarding claims 1 & 1 1, it is unclear how "changes between the standard samples 
before infection and after infection" (lines 16-17 and lines 21-22) can occur because the 
generated samples are (1) generated after infection and (2) always infected. 

Regarding claims 8 & 18, the limitation "the infected host object" lacks antecedent basis 
in the claims. 

Regarding claims 7 & 17, the claims contain the trademark/trade names DOS, 
WINDOWS and UNIX. Where a trademark or trade name is used in a claim as a limitation to 
identify or describe a particular material or product, the claim does not comply with the 
requirements of 35 U.S.C. 1 12, second paragraph. See Ex parte Simpson, 218 USPQ 1020 (Bd. 
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App. 1982). The claim scope is uncertain since the trademark or trade name cannot be used 
properly to identify any particular material or product. A trademark or trade name is used to 
identify a source of goods, and not the goods themselves. Thus, a trademark or trade name does 
not identify or describe the goods associated with the trademark or trade name. In the present 
case, the trademark/trade name is used to identify/describe different brands of operating systems 
and, accordingly, the identification/description is indefinite. 

Regarding claims 9-10 & 19-20, the limitation "necessary system files" is unclear 
because (1) a peripheral storage does not require any system files and (2) what files may be 
"necessary" for one computing environment may not be necessary for another, therefore 
rendering the claim indefinite. 

Regarding claims 8 & 18, the phrase "i.e." renders the claim indefinite because it is 
unclear whether the limitation(s) following the phrase are part of the claimed invention. See 
MPEP§ 2173.05(d). 

Regarding claims 8 & 1 8, the limitation "the virus is virtually ran to restore the original 
object" is unclear because the specification discloses the virus-cleaning program cleaning the 
infected object using information learned from running the virus. As the claim suggests that the 
virus cleans the infected object, the claim is unclear. For the purposes of this Office Action, it is 
understood that the virus-cleaning program cleaning the infected object using information 
learned from running the virus. 

Regarding claims 21-22, it is understood that "a computer readable recording medium" 
and a "transmission medium" cannot "cause a computer to execute . . . steps" therefore the claim 
is indefinite. However, "a computer readable recording medium containing instructions for 
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causing ..." (claim 21) and a "transmission medium containing instructions for causing ..." 
(claim 22) would be definite in this respect; however, "transmission medium" is not defined in 
the specification. While computer readable recording mediums (such as floppy disks) are well 
known in the art (as recited in claim 2 1 ), a transmission medium containing instructions (as 
recited in claim 22) is indefinite. 

Claim Rejections - 35 USC § 103 

9. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

10. Claims 1, 8, 1 1, 1 8, 21 & 22 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over U.S. Patent 5,842,002 to Schnurer et al. (Schnurer), in view of U.S. Patent Application 
Publication 2002/0073055 to Chess. 

Regarding claims 1, 11,21 & 22, Schnurer discloses simulating in a computer a virtual 
computer circumstance/trapping device (col. 5, lines 7-10 & col. 6, lines 64-67) on which the 
computer viruses reside, providing a plurality of objects or baits/files to be infected by computer 
viruses that induce virus infection (col. 7, lines 39-43), loading a target object/data stream (col. 6, 
line 64 - col. 7, line 1 1 & col. 7, lines 25-52) to be scanned into said simulated virtual computer 
circumstance/trapping device, activating/executing the target object/virus to be scanned in said 
simulated virtual computer circumstance/trapping device to induce the computer viruses possibly 
attached on said target object to infect the plurality of objects to be infected/files and generating 
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standard samples/infected files which have been infected (col. 7, lines 47-52), comparing the 
plurality of objects/files after processing in the activating/executing step with the plurality of 
objects/files to be infected originally provided, determining whether there is any change (CRC 
check) or not; if there is a change, the target object to be scanned contains virus, otherwise the 
target object to be scanned is free of viruses (col. 7, lines 39-52). Schnurer lacks analyzing and 
learning from and cleaning the viruses. However, Chess teaches that to detect and remove 
previously unknown viruses fl[2), a system is designed to maintain a database of information 
associated with documents fl[6) and scanning documents to detect changes from those 
characteristics recorded in the database (TJ25-27) and restoring the changed documents to their 
original condition or to a functionally equivalent state fl[32), by for example removing all macros 
from a document which previously contained none fl[32). Therefore, it would have been obvious 
to one having ordinary skill in the art at the time the invention was made to modify Schnurer to 
analyze and learn from the viruses by analyzing the generated standard samples (infected files) 
and extracting information and knowledge on the viruses (changes) indicated by changes 
between the standard samples before infection (as is kept in Chess's database) and after infection 
(as in Chess's scanned documents) when it is determined that said target object to be scanned 
contains a virus and to clean from the infected target object the virus's body (as in Chess's 
macro) and modifying key information which has been changed by said virus (restoring to 
functionally equivalent state) indicated by changes between the standard samples before 
infection and after infection and on the basis of the modification that the viruses have made to 
said infected files. One of ordinary skill in the art would have been motivated to perform such a 
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modification to repair files infected with unknown viruses, as taught by Chess (ffif 2, 6, 25-27 & 
32). 

Regarding claims 8 & 18, Schnurer, as modified above, teaches virtually running the 
virus (col. 6, line 64 - col. 7, line 1 1 & col. 7, lines 25-52) and restoring the original target object 
from the infected host object (Chess Iffl 2, 6, 25-27 & 32). 

11. Claims 3-4 & 13-14 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Schnurer and Chess, as applied to claims 1 & 1 1 above, in further view of Connectix Virtual PC 
software by Connectix, Described in "Connectix Virtual PC" datasheet (VPC) and "Connectix 
Virtual PC Family Frequently Asked Questions" (FAQ). 

Regarding claims 3 & 13, Schnurer, as modified above, is silent regarding details of the 
emulation. However, Connectix teaches simulating a Central Processing Unit (CPU)/Pentium 
chip (VPC, p. 1, H2) 5 simulating an Operating System (OS)/PC-based operating system (VPC, p. 
1, TJ1 & 1J3), and simulating peripheral storage devices by simulating storage space and structures 
of various peripheral storage devices/CD-ROM and PC disk/floppy disk (VPC, p. 2, 1(3). Virtual 
PC is used to run applications for one platform (such as Windows) on another platform (such as 
Macintosh). Further, FAQ teaches that Virtual PC simulates both a hard disk and memory for 
the emulated software, in this case, Windows (FAQ, p. 9, 1f7). Therefore, it would have been 
obvious to one having ordinary skill in the art at the time the invention was made to simulate a 
CPU, OS, storage device and memory. One of ordinary skill in the art would have been 
motivated to perform such a modification to run Windows from within a Macintosh, as taught by 
Connectix (VPC, p. 1, 1(1-3, p. 2, 1[3 & FAQ, p. 9, 1)7). 
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Regarding claims 4 & 14, Schnurer discloses multiple baits of different sizes and contents 
(FAT, executables) (col. 8, lines 13-20). 

12. Claims 5-7 & 15-17 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Schnurer, Chess and Connectix, as applied to claims 4 & 14 above, in further view of U.S. 
Patent 6,067,410 to Nachenberg. 

Regarding claims 5 & 15, Schnurer discloses multiple baits of different sizes and contents 
(FAT, executables) (col. 8, lines 13-20), but lacks specifically a specific virus. However, 
Nachenberg teaches that the bulk of software viruses in DOS based systems are COM files. 
Therefore, it would have been obvious to one having ordinary skill in the art at the time the 
invention was made to include DOS COM bait files. One of ordinary skill in the art would have 
been motivated to perform such a modification to include as bait commonly infected files, as 
taught by Nachenberg (col. 8, lines 13-20). 

Regarding claims 6 & 16, Schnurer discloses simulating the system time to generate 
virtual system date and time for inducing the viruses that are sensitive to date and time (col. 7, 
lines 33-35). 

Regarding claims 7 & 17, Schnurer, as modified above, discloses simulating WINDOWS 
(Connectix VPC document, p. 1, |3). 

13. Claims 9-10 & 19-20, as best understood, are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Schnurer, Chess and Connectix, as applied to claims 3 & 13 above, in further 
view of U.S. Patent 5,537,636 to Uchida et al. (Uchida), U.S. Patent 6,356,915 to Chtchetkine et 
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al. (Chtchetkine) & U.S. Patent 6,192,456 to Lin et al. (Lin). Schnurer as modified above, 
discloses system files and bait files for inducing viruses (Schnurer col. 6, line 64 - col. 7, line 1 1 
& col. 7, lines 25-52) and teaches that VPC is software emulation of the hardware on a PC 
(Connectix FAQ, p. 9, f 6-7), but lacks explicit disclosure of sectors, tracks, cylinders, a primary 
boot sector and corresponding blank sector of the No. 0 track, next boot sector, File Allocation 
Table, root directory sector. However, Uchida teaches that disks contain cylinders, tracks and 
sectors (col. 6, line 61 - col. 7, line 65), a primary boot sector (col. 8, lines 13-15) and 
corresponding blank sector of the number 0 track (col. 8, lines 28-32), and a File Allocation 
Table (col. 5, lines 46-50). Further, Chtchetkine teaches that the logical structure on the FAT file 
system requires a boot sector that describes the root directory sectors within the disk (col. 2, lines 
22-27). Therefore, it would have been obvious to one having ordinary skill in the art at the time 
the invention was made to assign memory to simulate a virtual hard disk including a space by 
sector number, track number and cylinder number, a primary boot sector and corresponding 
blank sector of the No. 1 track, File Allocation table and root directory sector. One of ordinary 
skill in the art would have been motivated to perform such a modification to simulate in software 
the hardware (hard disk, floppy disk) of a PC, as taught by Connectix (Connectix FAQ, p. 9, ^[6- 
7), Uchida (col. 5, lines 46-50, col. 6, line 61 - col. 7, line 65, col. 8, lines 13-15 & col. 8, lines 
28-32) and Chtchetkine (col. 2, lines 22-27). As modified, Schnurer lacks a next boot sector. 
However, Lin teaches that storing multiple partitions requires multiple boot sectors (Fig. 3 & col. 
4, lines 52-54). Therefore, it would have been obvious to one having ordinary skill in the art at 
the time the invention was made to include a next boot sector. One of ordinary skill in the art 
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would have been motivated to perform such a modification to use multiple partitions, as taught 
by Lin (Fig. 3 & col. 4, lines 52-54). 

Conclusion 

14. Applicant's amendment necessitated the new ground(s) of rejection presented in this 
Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). 
Applicant is reminded of the extension of time policy as set forth in 37 CFR 1 . 1 36(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1 . 1 36(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the date of this 
final action. 

15. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Michael J. Simitoski whose telephone number is (571) 272-3841 . 
The examiner can normally be reached on Monday - Thursday, 6:45 a.m. - 4:15 p.m.. The 
examiner can also be reached on alternate Fridays from 6:45 a.m. - 3:15 p.m. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Gregory Morse can be reached at (571) 272-3838. 

Any response to this action should be mailed to: 

Commissioner for Patents 
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P.O.Box 1450 

Alexandria, VA 22313-1450 



Or faxed to: 

(571)273-8300 

(for formal communications intended for entry) 

Or: 

(571) 273-3841 (Examiner's fax, for informal or draft communications, please 
label "PROPOSED" or "DRAFT") 

Any inquiry of a general nature or relating to the status of this application or proceeding should 
be directed to the receptionist whose telephone number is (571) 272-2100. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov, Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 





September 22, 2005 
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